Privacy Policy and KVKK / GDPR Privacy Notice

1. Identity of the Data Controller and Application Procedure

Joint Data Controllers: Baran Emre Güreş and Barış Halil İnal (epicurIST Simple Partnership). Notification Address: Metro, Emniyetevleri Sapphire B4 Floor, 4.Levent, 34415 Kağıthane/Istanbul, Republic of Türkiye. Contact Email: social@epicurist.app

Pursuant to Article 10 of the KVKK and Articles 13/14 of the GDPR, your personal data is processed jointly and severally by Baran Emre Güreş and Barış Halil İnal (epicurIST Simple Partnership) (“epicurIST”) in their capacity as Joint Data Controllers. The allocation of duties, powers, and responsibilities among the joint data controllers has been established in accordance with Article 26 of the GDPR.

In accordance with the Communiqué on the Principles and Procedures for the Request to Data Controller, our users may exercise their rights under Article 11 of the KVKK and Articles 15–22 of the GDPR by submitting a request to social@epicurist.app via the email address registered in our system. For requests submitted via a registered email address, specifying the Name-Surname and the subject of the request is sufficient, and a Turkish ID Number is not required. However, for requests submitted from email addresses not registered in our system or for written applications, a Turkish ID Number (or Passport Number for foreign nationals) may be requested for identity verification purposes.

2. Processed Personal Data, Data Collection Methods, and Legal Grounds

Your personal data is collected via automated or semi-automated electronic methods when you download the Application to your device, create an account, share content, and utilize in-app features.

Account and Profile Information — Email address, username, profile photo, optional occupation and social media links (First/last name is not mandatorily requested). Collection method: Direct input provided by the user via form. KVKK legal basis: Art. 5/2-(c) Establishment and performance of the user membership agreement. GDPR legal basis: Art. 6(1)(b) Performance of Contract.

Real-time and Approximate Location Data — Instant GPS coordinates (Only if you have granted location permission; processed in real-time when the "Places Near Me" feature is used and to show your own position on the map screen; no background tracking is performed, and data is not saved to the database or sent to third parties). Collection method: Device Location Services. KVKK legal basis: Art. 5/1 Explicit Consent (Optional opt-in permission at the device level). GDPR legal basis: Art. 6(1)(a) Explicit Consent.

Visual Data (Photo / Gallery) — Only photo files selected by the User to be added to a post or profile. Collection method: System Image Picker (PHPickerViewController / Android Activity Result). KVKK legal basis: Art. 5/1 Explicit Consent (Optional device permission). GDPR legal basis: Art. 6(1)(a) Explicit Consent.

Technical Data and Security — Session tokens (JWT Tokens), Device Notification Key (Push Token), device model, OS version, crash logs. Collection method: Background client-server communication and device notification services. KVKK legal basis: Art. 5/2-(f) Legitimate interest & Art. 5/2-(ç) Obligation to fulfill data security requirements. GDPR legal basis: Art. 6(1)(f) Legitimate Interests & Art. 6(1)(c) Legal Obligation.

Biometric data processing, facial recognition, or personal profiling analysis is strictly not conducted on profile photos or venue images uploaded by users. Such images are deemed to be made public by the data subject (Art. 5/2-(d) of the KVKK) by virtue of being uploaded to the system through the user's own volition, and are processed solely for the purpose of providing the social functionality of the application. Sensitive location data is processed instantly only if the user grants permission at the device level; a prominent in-app disclosure is displayed on the application screen prior to requesting location permission.

3. User Content, Publicly Available Data, and Private Data

Public Data: Reviews, venue ratings, public lists, and uploaded photos that you share on the Application in a manner accessible to all users are processed within the scope of data made public by the data subject pursuant to Article 5/2-(d) of the KVKK, and for the performance of the membership agreement pursuant to Article 5/2-(c) of the KVKK / Article 6(1)(b) of the GDPR.

Private / Confidential Data and Complaints: Private lists accessible solely by you, as well as in-platform complaints, reporting, and support requests, are not considered publicly available data; such data is processed based on the legal grounds set forth in Article 5/2-(c) and Article 5/2-(f) of the KVKK.

Content Moderation: For the purposes of maintaining platform security and enforcing community standards, spam, misleading, or unlawful content may be subjected to moderation screening.

4. Session Security, Encryption, and Technical Measures

The security of your session data is safeguarded through high-level technical measures pursuant to Article 12 of the KVKK and Article 32 of the GDPR:

Your session keys (Access and Refresh Tokens) are stored in encrypted format within isolated iOS Keychain on iOS devices and hardware-backed EncryptedSharedPreferences infrastructure on Android devices.

All data streams between the Application and the servers are transmitted via TLS 1.2 or higher encryption protocols.

Data contained within our database is protected by Row Level Security (RLS).

Upon logging out or account deletion, local tokens are wiped, and session identifiers on the server infrastructure are invalidated immediately.

5. Map Services: Google Maps API and Server-Side Proxy Architecture

Google Maps and Google Places API services are utilized within the Application for map display and venue search functionalities.

Venue Search: In order to protect your privacy, your venue search queries are not sent directly from your device to Google servers; they are routed through a Server-Side Proxy controlled by epicurIST. During this process, your IP address, device identity, and User ID are not forwarded to Google (anonymization); your location coordinates are never sent to Google, and searches are narrowed only to the boundaries of Istanbul. Consequently, Google services are prevented from profiling or tracking your actual IP address or individual identity through your search queries.

Map Display: The map itself (map tiles and the map image on venue pages) is loaded on your device directly from the map provider: Google Maps, Apple Maps or Mapbox. During this loading, your device's IP address and the area you view on the map reach the respective provider; your epicurIST account information is not transmitted to these providers.

Venue Photos: Google photos on venue pages are loaded on your device directly from Google; during this, your IP address and the venue being viewed reach Google.

6. Data Transfer and Cross-Border Data Transfers

In accordance with our policies, your personal data is strictly not transferred or sold to third parties for advertising, marketing, profiling, or commercial data sale purposes without obtaining your explicit consent.

Because a Server-Side Proxy is employed for venue search, your search queries are not transferred to Google together with your identity; the fact that your IP address reaches the map provider while the map display loads is explained in Section 5. In addition, for the delivery of mobile push notifications, your device notification key (Push Token) is transmitted to Apple APNs (Apple Inc.) and Google FCM (Google LLC) infrastructures. In the event that our server and database infrastructure is hosted in secure cloud data centers located abroad, your personal data is transferred abroad by ensuring the necessary administrative and technical safeguards pursuant to Article 9 of Law No. 6698 on KVKK (as amended by Law No. 7499) (Standard Contractual Clauses) and Chapter V of the GDPR. Currently, our server and database are stored within the borders of the Republic of Türkiye in compliance with the relevant articles of the KVKK.

7. App Store and Google Play Store Compliance Declarations and Account/Data Deletion Channels

epicurIST complies with all data transparency requirements pursuant to Apple App Store Review Guidelines (Guideline 5.1.1) and Google Play Store User Data Policies:

Apple Privacy Manifest and Required Reason APIs: Our Application incorporates the Privacy Manifest architecture mandated for iOS 17 and higher versions. System APIs utilized for executing user session security and hardware-backed key storage are strictly accessed solely for the execution of core application session functions under legal reasons permitted by Apple. Fingerprinting or tracking activities are strictly not performed on user devices.

Account and Data Deletion Channels:

A. In-App Deletion: All data can be immediately deleted by navigating through Profile → Settings → Manage Account → Delete My Account.

B. Deletion via External Web Page: Even if the Application has been uninstalled from the device, a deletion request may be generated via the Web Account Deletion Form accessible at https://epicurist.app/delete-account.

Deletion Processes and Data Destruction: Upon receipt of a deletion request, data is erased immediately from the primary database and destroyed within system backups within 30 days at the latest. Logs retained pursuant to legal statutory obligations are stored for a maximum period of 2 years.

Tracking and ATT Declaration: Advertising identifiers (IDFA/GAID) are not collected, data is not sold, and tracking within the scope of App Tracking Transparency (ATT) is not conducted.

8. Rights of the Data Subject and Remedies (KVKK Art. 11 & GDPR Art. 15–22)

As a data subject, you hold the following rights pursuant to Article 11 of the KVKK and Articles 15–22 of the GDPR:

Right to learn whether your personal data is processed, and to request information if processed (Right of Access),

Right to request correction of incomplete or inaccurate personal data (Right to Rectification),

Right to request erasure/destruction of your personal data within the framework of Article 7 of the KVKK and Article 17 of the GDPR (Right to be Forgotten),

Right to request restriction of processing (GDPR Art. 18) and right to object to processing activities (GDPR Art. 21),

Right to receive a copy of your personal data processed through automated systems in a structured and machine-readable format (Right to Data Portability - GDPR Art. 20) (Directly accessible via the in-app Profile → Settings → Manage Account → Download My Data button),

Right to Lodge a Complaint with a Supervisory Authority: If you believe your data protection rights have been infringed, your right to lodge a complaint with the Personal Data Protection Authority (KVKK) in Türkiye or with the competent Data Protection Authority (DPA) in EU member states remains reserved (GDPR Art. 77).

You may submit your requests to the email address social@epicurist.app.

9. Children's Privacy and Age Limit

The epicurIST mobile application is not designed for children under the age of 18, and personal data from individuals under 18 years of age is not knowingly collected through our platform. In the event it is determined that personal data belonging to an individual under 18 has been processed without parental or guardian consent, such data and the associated account shall be erased from our systems immediately.

10. Integrated Third-Party SDKs, Cookies, and Privacy Policy Updates

Advertising or third-party tracking cookies are strictly not utilized in our Application. Solely the technical and infrastructural Software Development Kits (SDKs) listed below are used to ensure the uninterrupted, secure, and performant operation of the mobile application:

Apple APNs (Apple Inc.) — Purpose of Use: Push notification delivery to iOS devices. Data Type: Device Notification Key (Push Token). Security: Apple Privacy Standards.

Google FCM (Google LLC) — Purpose of Use: Push notification delivery to Android devices. Data Type: Device Notification Key (Push Token). Security: Google Cloud Security.

Google Maps API (Google LLC) — Purpose of Use: Map display, venue search and venue photos. Data Type: Venue search query (anonymized); IP address while the map display loads; IP address and the viewed venue while venue photos load. Security: Server-Side Proxy for search (IP & ID Masking).

Dorukcloud (Doruknet) — Purpose of Use: Database and cloud hosting. Data Type: Account, Content, and Transaction Logs. Security: Encrypted at Rest & RLS / KVKK SCC.

epicurIST may update this Privacy Policy from time to time in alignment with legislative amendments or platform policy updates. The updated text shall become effective on the date it is published via the Application and website.